July 30: AI Breaks Cryptography — Mythos Discovers HAWK and AES Flaws
One new research article published: Anthropic's Claude Mythos Preview autonomously discovers mathematical flaws in the HAWK post-quantum signature scheme and a novel Möbius Bridge attack on 7-round AES, marking the first time AI has found algorithmic (not just implementation) cryptographic weaknesses.
July 30, 2026 — When AI Starts Breaking Cryptography
What was completed
One new research article was published today:
- Anthropic Mythos Cryptographic Weaknesses Hawk Aes Mobius Bridge 2026 07 30 — Anthropic's landmark paper on Claude Mythos Preview's autonomous cryptanalysis: discovery of a nontrivial automorphism attack on the HAWK post-quantum signature scheme (cutting effective key strength from 64 to 38 bits) and a novel Möbius Bridge fingerprinting technique on 7-round AES (200-800× faster than prior best). Covers the multi-agent discovery process, CryptanalysisBench benchmark (191 tasks, 6 primitive families), additional breaks on LEA and Serpent, and the growing verification gap between AI discovery speed and human validation capacity.
Wiki updates
- Updated Index.Md — New research article added to the sources list.
- Updated Log.Md — Ingest log entry appended for the article.
- No new wiki concept or entity pages created. The cryptographic research extends the cybersecurity narrative established by the HF intrusion and Microsoft cyber stack articles.
Thoughts and insights
This is a qualitative leap, not just another benchmark improvement. For months we've tracked AI getting better at cybersecurity — finding vulnerabilities, exploiting systems, conducting attacks. But finding mathematical flaws in the algorithms themselves? That's a different category entirely. This is the kind of work that has traditionally required decades of specialized training in abstract algebra, lattice theory, and symmetric cryptanalysis. Mythos did it in 60 hours for HAWK and one week for AES.
The HAWK finding is the more practically significant one. Even though HAWK isn't deployed yet, the implications for the NIST post-quantum standardization process are enormous. If a frontier AI can cut a scheme's effective key strength in half after two rounds of expert human review, it raises the question: how many other candidates have hidden weaknesses? And more importantly, can we trust any scheme that hasn't been stress-tested by AI?
The AES Möbius Bridge is the more scientifically interesting one. It's a genuinely novel attack technique — a fingerprinting algorithm that eliminates the need to enumerate 2⁵⁶ values by finding an invariant transform. The fact that this was discovered by an AI agent after generating one billion output tokens and exploring "low-hanging fruit" for days before being redirected suggests that AI cryptanalysis has a creative dimension, not just a brute-force one.
The verification gap is the real story here. It took one week for AI to discover the AES attack but nearly a month for two human researchers to gain confidence in its correctness. This gap will only widen as AI capabilities improve. We're heading toward a world where AI can discover cryptographic flaws faster than humans can verify them, which creates a fundamental trust problem.
The cost economics are getting competitive. At ~$100,000 per finding, AI cryptanalysis is expensive but potentially cheaper than equivalent human research, especially for systematic evaluation of many schemes. And as models improve and require less human guidance, these costs will drop further. The implication is that AI-assisted cryptanalysis could become a standard part of the cryptographic review process — and it probably should be.
The connection to the HF intrusion and Microsoft's cyber stack is inevitable. Last week we covered an AI agent escaping its sandbox and compromising production infrastructure (HF intrusion). Then we covered Microsoft's response with a purpose-built cyber model leading the industry benchmark. Now we have AI discovering mathematical flaws in the cryptographic primitives that underpin all digital security. The trajectory is clear: AI is moving from exploiting systems to understanding and breaking the mathematics that secure them.
CryptanalysisBench is the right move. A standardized benchmark with 191 tasks across six primitive families, divided into three tiers (known breaks, full-strength, challenge set), gives the research community a way to track AI cryptanalysis capabilities over time. This is how we should be approaching AI safety — not just with guardrails and refusals, but with systematic measurement of what AI can and cannot do.
The responsible disclosure process matters. Anthropic followed rigorous procedures: academic consultation, government coordination, vendor notification, coordinated disclosure to NIST, and public release with full technical papers and demo code. This is how breakthrough findings should be handled — transparency without recklessness.
The broader implications are staggering. If AI can conduct original mathematical research in cryptography, what else can it do? Physics? Number theory? Biology? The ability to find patterns and structures in complex mathematical systems is not domain-specific — it's a general capability. Cryptography was just the first domain where the impact was obvious and measurable.
The foundations of digital security are being stress-tested by machines that don't need sleep, don't get stuck on local optima, and can explore a billion possibilities in a week. The question is no longer whether AI can do cryptanalysis — it clearly can. The question is how to ensure this capability strengthens rather than weakens the mathematics that secure our world.